Cybersecurity Incident Response Plan (Hong Kong)

A Cybersecurity Incident Response Plan in Hong Kong sets out a structured account of the matters it is intended to track.

Data Protection Principle 4 (DPP4) of Schedule 1 to the Personal Data (Privacy) Ordinance (Cap. 486) requires every data user — any organisation that controls the collection, holding, processing, or use of personal data — to take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. The Office of the Privacy Commissioner for Personal Data (PCPD) has published guidance stating that a documented data breach response procedure is a key element of DPP4 compliance. Organisations that lack a plan when a breach occurs may be found in breach of DPP4 in any subsequent PCPD investigation.

For financial institutions regulated by the Hong Kong Monetary Authority (HKMA), the Supervisory Policy Manual (SPM) module TM-E-1 (Management of Cybersecurity Risks) requires authorised institutions to establish a cybersecurity incident management framework covering incident identification, response, recovery, and reporting. The HKMA’s Cybersecurity Fortification Initiative (CFI) provides a structured programme for enhancing cyber resilience. For corporations licensed by the Securities and Futures Commission (SFC), the SFC’s Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading require licensed persons to have documented incident response procedures.

The Crimes Ordinance (Cap. 200) criminalises unauthorised access to computer programs and data under sections 27A and 161. When an organisation is a victim of a cyber attack — ransomware, hacking, or data exfiltration — the incident response plan supports evidence preservation for referral to the Hong Kong Police Force’s Cyber Security and Technology Crime Bureau (CSTCB), which investigates cybercrime and liaises with the Police Technology Crime Division.

Hong Kong does not currently have mandatory data breach notification under the PDPO as of 2026 — proposed amendments to introduce mandatory notification remain pending. However, the PCPD’s Guidance on Data Breach Handling strongly encourages voluntary notification to the PCPD and affected individuals when a breach poses real risk of harm. An incident response plan that includes notification decision procedures positions the organisation to act quickly and demonstrate responsible data governance. Section 26 of the Personal Data (Privacy) Ordinance (Cap. 486) empowers the PCPD to issue enforcement notices requiring data users to remedy DPP4 contraventions identified after a cybersecurity incident. Section 161 of the Crimes Ordinance (Cap. 200) criminalises access to a computer with dishonest intent, and Section 27A prohibits unauthorised access to a computer — both sections are directly relevant when an organisation is the victim of hacking and decides whether to report the attack to the Hong Kong Police Force Cyber Security and Technology Crime Bureau (CSTCB). Forms-legal.com provides this Cybersecurity Incident Response Plan template aligned with PDPO DPP4, HKMA TM-E-1, SFC hacking guidelines, and PCPD data breach guidance for organisations across the Hong Kong Special Administrative Region.

A Cybersecurity Incident Response Plan in Hong Kong is required before any cyber incident occurs — organisations that develop their response procedures after an attack are invariably slower, less effective, and more exposed to regulatory and reputational consequences than those with pre-established plans.

Every organisation that processes personal data of Hong Kong individuals needs a plan to comply with DPP4 of the Personal Data (Privacy) Ordinance (Cap. 486). The PCPD’s published enforcement decisions consistently cite the absence of documented incident response procedures as an aggravating factor in breach investigations. Organisations investigated by the PCPD after a data breach who lack written response plans face higher risk of enforcement notices being issued under Cap. 486.

Authorised institutions regulated by the Hong Kong Monetary Authority (HKMA) — licensed banks, restricted licence banks, and deposit-taking companies — must comply with SPM module TM-E-1, which explicitly requires a cybersecurity incident management framework. HKMA-regulated institutions must report material cybersecurity incidents to the HKMA within specified timeframes, and the incident response plan establishes the internal escalation and reporting procedures that make timely HKMA notification possible.

Corporations licensed by the Securities and Futures Commission (SFC) — including licensed intermediaries, asset managers, and digital asset platforms — must comply with SFC circulars on cybersecurity risk management. The SFC has issued regulatory actions against licensed corporations that suffered cyber incidents without adequate incident response capabilities.

Healthcare organisations — Hospital Authority hospitals, private hospitals, clinics, and diagnostic laboratories — process highly sensitive patient health data. A cybersecurity incident affecting patient records creates both a PDPO DPP4 compliance issue and potential liability under the Hospital Authority Ordinance (Cap. 113) and the Medical Registration Ordinance (Cap. 161). An incident response plan specific to healthcare IT environments is essential.

Organisations that are part of critical infrastructure — telecommunications providers licensed under the Telecommunications Ordinance (Cap. 106), utilities, and transportation operators — may be subject to sector-specific cybersecurity requirements from the Office of the Government Chief Information Officer (OGCIO) and should have incident response plans aligned with Hong Kong’s Critical Infrastructure Protection framework.

Any organisation operating e-commerce platforms, payment systems, or digital services that collect Hong Kong customer financial data — credit card numbers, bank account details — faces the risk of financial fraud following a data breach and needs a plan that addresses both the cybersecurity response and the notification obligations to affected customers and the relevant regulators.

A Cybersecurity Incident Response Plan for Hong Kong organisations must address nine core elements to satisfy DPP4 of the Personal Data (Privacy) Ordinance (Cap. 486), HKMA SPM module TM-E-1 requirements for authorised institutions, and PCPD data breach handling guidance.

Incident Classification Framework defines what constitutes a cybersecurity incident for the organisation and establishes severity tiers — from Tier 1 (minor, low impact, no personal data affected) through Tier 4 (critical, large-scale personal data breach, operational disruption, regulatory reporting required). Examples of classified incidents include unauthorised system access, ransomware infection, phishing credential compromise, distributed denial-of-service (DDoS) attack, insider data theft, and lost or stolen devices containing personal data.

Incident Response Team (IRT) identifies each IRT member by name and role — typically the Chief Information Security Officer (CISO) or IT Security Manager, the Data Protection Officer or PDPO Compliance Lead, Legal Counsel, the Communications Manager, and Senior Management. Contact details (24/7 mobile numbers) and authority levels must be documented and updated quarterly.

Detection and Initial Reporting establishes the monitoring systems, alerting tools (SIEM, intrusion detection), and employee reporting channels through which potential incidents are identified and escalated to the IRT. Every employee should know the single contact point for reporting a suspected incident, and the plan should specify the response time target from detection to IRT notification (typically 1 hour for Tier 3 and 4 incidents).

Containment Procedures sets out the immediate technical steps to stop the incident from spreading — isolating affected systems from the network, disabling compromised user accounts, blocking malicious IP addresses or domains, and preserving forensic evidence by creating disk images before remediation. Evidence preservation is critical if law enforcement referral to the Hong Kong Police CSTCB is anticipated.

Investigation and Forensic Analysis specifies how the IRT investigates the scope, cause, and impact of the incident — identifying the attack vector, the personal data or systems affected, the duration of the breach, and the identity of the threat actor where determinable. Engagement of external cybersecurity forensic specialists (such as those recommended by the HKMA’s list of approved cybersecurity service providers) should be addressed.

Notification Decision Tree guides the IRT through the decision of whether to notify the PCPD (voluntary under current Cap. 486), affected data subjects, the HKMA (mandatory for material incidents affecting HKMA-regulated institutions within the required timeframe), the SFC (mandatory for licensed corporations), the Hong Kong Police CSTCB, and any overseas regulators where cross-border data was affected. The PCPD’s notification criteria — real risk of harm to data subjects — should be applied systematically.

Recovery and Service Restoration defines the steps for restoring affected systems from clean backups, verifying the integrity of restored systems before bringing them back into production, and resuming normal operations. Recovery time objectives (RTO) and recovery point objectives (RPO) should be referenced from the organisation’s Business Continuity Plan, which the Cybersecurity Incident Response Plan should complement.

Post-Incident Review requires the IRT to conduct a structured debrief within 14 days of incident resolution, document lessons learned, update the plan and security controls to address identified weaknesses, and report findings to senior management and the board. HKMA-regulated institutions must maintain records of all material cybersecurity incidents and their resolution for HKMA supervisory review.

Testing and Training specifies the schedule for tabletop exercises simulating different incident scenarios, technical penetration testing and vulnerability assessments, and employee phishing simulation exercises — all recommended by the HKMA CFI programme and the PCPD’s data governance guidance to maintain organisational readiness. The forms-legal.com Cybersecurity Incident Response Plan (Hong Kong) template covers the mandatory elements under Personal Data (Privacy) Ordinance (Cap. 486).